> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prysm1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance preview

> Dry-run the Policy-as-Code compliance gate — classify a prompt and see which models a policy allows vs excludes, the Compliance Cost Premium, and a sample attestation. No model is called.

<Note>
  **POST** `https://api.prysm1.com/v2/compliance/preview` · Requires authentication
</Note>

A **pure dry-run** of [compliance routing](/concepts/compliance): it classifies the prompt
locally and applies your policy as a hard exclusion filter, then returns exactly what
*would* happen — **without calling any model**. Because nothing is executed, it costs
nothing and works even when no provider keys are configured. Use it to prove, before a cent
is spent, that a request would only ever be routed to approved providers.

<Warning>
  This endpoint lives under **`/v2`**, not `/v1`. The SDKs target it automatically with
  `client.compliance_preview(...)` (Python) / `client.compliancePreview(...)` (Node).
</Warning>

## Authorization

<ParamField header="Authorization" type="string" required>
  Your secret key as a bearer token: `Bearer prysm_sk_...`
</ParamField>

## Body

<ParamField body="prompt" type="string">
  The text to classify and gate. Provide either `prompt` or `messages`.
</ParamField>

<ParamField body="messages" type="array">
  An OpenAI-style conversation; the last `user` message is classified. Used if `prompt` is
  omitted.
</ParamField>

<ParamField body="compliance" type="object">
  The Policy-as-Code spec. Every field is optional; an all-empty policy is **inert**
  (pass-through). See [compliance routing](/concepts/compliance) for the model.

  <Expandable title="compliance">
    <ParamField body="provider_allowlist" type="string[]">If set, **only** these providers are eligible (e.g. `["anthropic","openai"]`).</ParamField>
    <ParamField body="provider_denylist" type="string[]">Providers that are always excluded.</ParamField>
    <ParamField body="jurisdiction" type="string[]">Allowed governing jurisdictions (e.g. `["US","EU"]`).</ParamField>
    <ParamField body="data_residency" type="string[]">The provider's data regions must be a subset of these (e.g. `["EU"]`).</ParamField>
    <ParamField body="frameworks" type="string[]">Frameworks the provider must support (e.g. `["GDPR","CCPA"]`).</ParamField>
    <ParamField body="certifications" type="string[]">Certifications the provider must hold (e.g. `["SOC2","HIPAA","ISO27001"]`).</ParamField>
    <ParamField body="block_data_classes" type="string[]">Data classes barred from non-cleared providers: `PII`, `PHI`, `FINANCIAL`, `SECRETS`.</ParamField>
    <ParamField body="require_zero_retention" type="boolean">Require a zero-retention / no-train provider mode.</ParamField>
  </Expandable>
</ParamField>

<ParamField body="brain_config" type="object">
  A [BRAIN.md](/concepts/brain-md) config whose `compliance:` block supplies the policy.
  Used when `compliance` is omitted; falls back to the server-discovered BRAIN.md.
</ParamField>

## Response

<ResponseField name="active" type="boolean">
  Whether a policy was in force. `false` means inert — all models eligible, and only the
  classification fields plus `note` are returned.
</ResponseField>

<ResponseField name="ok" type="boolean">
  `true` if at least one approved model can serve the request. `false` is a hard stop —
  the policy excludes every model.
</ResponseField>

<ResponseField name="policy" type="object">
  The compiled policy, echoed back (allowlist/denylist, jurisdictions, residency, required
  frameworks & certifications, blocked data classes, zero-retention).
</ResponseField>

<ResponseField name="detected_classes" type="string[]">
  Sensitive data classes found in the text, e.g. `["PII","FINANCIAL"]`. Empty if none.
</ResponseField>

<ResponseField name="classification" type="object">
  Per-class detail: each detected class maps to the kinds that matched (e.g.
  `{ "FINANCIAL": ["iban","credit_card"] }`). Pattern matches only — never executed.
</ResponseField>

<ResponseField name="allowed_models" type="string[]">
  Model ids that survive the policy and could serve the request.
</ResponseField>

<ResponseField name="excluded_models" type="object">
  Map of excluded model id → list of human-readable reasons (e.g. `jurisdiction 'US' not in ['EU']`).
</ResponseField>

<ResponseField name="compliance_cost_premium" type="object">
  What staying compliant costs versus the cheapest unrestricted model.

  <Expandable title="compliance_cost_premium">
    <ResponseField name="compliant_available" type="boolean">Whether any compliant model exists.</ResponseField>
    <ResponseField name="cheapest_unrestricted" type="string">Cheapest model ignoring the policy.</ResponseField>
    <ResponseField name="unrestricted_min_usd_mtok" type="number">Its blended price per MTok.</ResponseField>
    <ResponseField name="cheapest_compliant" type="string">Cheapest model that satisfies the policy.</ResponseField>
    <ResponseField name="compliant_min_usd_mtok" type="number">Its blended price per MTok.</ResponseField>
    <ResponseField name="premium_usd_mtok" type="number">Absolute premium per MTok (compliant − unrestricted).</ResponseField>
    <ResponseField name="premium_pct" type="number">The premium as a percentage.</ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="decision" type="object">
  The full exclusion decision: `policy`, `policy_active`, `detected_classes`, `allowed`,
  `allowed_count`, `excluded`, `excluded_count`, `matrix_version`.
</ResponseField>

<ResponseField name="sample_attestation" type="string">
  A sample SHA-256 compliance receipt (`sha256:...`) for the cheapest compliant model —
  present when `ok` is `true`. The same shape attaches to real runs' [PrysmProof](/concepts/prysmproof).
</ResponseField>

<ResponseField name="matrix_version" type="string">
  The Regulatory Compliance Matrix version used, e.g. `rcm-2026.06-baseline`.
</ResponseField>

<ResponseField name="note" type="string">
  Present only when `active` is `false` — explains the pass-through.
</ResponseField>

## Errors

| Status | `error` | Meaning                                               |
| ------ | ------- | ----------------------------------------------------- |
| `401`  | —       | Missing or invalid API key.                           |
| `422`  | —       | Neither `prompt` nor `messages` resolved to any text. |

<RequestExample>
  ```python Python theme={null}
  from prysm import Prysm

  client = Prysm()
  p = client.compliance_preview(
      "summarize this report",
      compliance={"jurisdiction": ["EU"], "frameworks": ["GDPR"], "data_residency": ["EU"]},
  )
  print(p["allowed_models"])
  print(p["compliance_cost_premium"])
  ```

  ```typescript Node theme={null}
  import { Prysm } from "@prysmai/sdk";

  const client = new Prysm();
  const p = await client.compliancePreview("summarize this report", {
    compliance: { jurisdiction: ["EU"], frameworks: ["GDPR"], data_residency: ["EU"] },
  });
  console.log(p.allowed_models, p.compliance_cost_premium);
  ```

  ```bash cURL theme={null}
  curl https://api.prysm1.com/v2/compliance/preview \
    -H "Authorization: Bearer $PRYSM_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "prompt": "summarize this report",
      "compliance": {
        "jurisdiction": ["EU"],
        "frameworks": ["GDPR"],
        "data_residency": ["EU"]
      }
    }'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "active": true,
    "ok": true,
    "policy": {
      "active": true,
      "allowed_jurisdictions": ["EU"],
      "data_residency": ["EU"],
      "required_frameworks": ["GDPR"],
      "block_data_classes": []
    },
    "detected_classes": [],
    "classification": {},
    "allowed_models": ["mistral-nemo", "mistral-medium-3"],
    "excluded_models": {
      "gpt-5.2": ["jurisdiction 'US' not in ['EU']"],
      "claude-sonnet-4.5": ["jurisdiction 'US' not in ['EU']"]
    },
    "compliance_cost_premium": {
      "compliant_available": true,
      "cheapest_unrestricted": "mistral-nemo",
      "unrestricted_min_usd_mtok": 0.02,
      "cheapest_compliant": "mistral-nemo",
      "compliant_min_usd_mtok": 0.02,
      "premium_usd_mtok": 0.0,
      "premium_pct": 0.0
    },
    "decision": {
      "policy": "policy",
      "policy_active": true,
      "detected_classes": [],
      "allowed": ["mistral-nemo", "mistral-medium-3"],
      "allowed_count": 2,
      "excluded": {
        "gpt-5.2": ["jurisdiction 'US' not in ['EU']"]
      },
      "excluded_count": 17,
      "matrix_version": "rcm-2026.06-baseline"
    },
    "sample_attestation": "sha256:a1b2c3d4e5f60718",
    "matrix_version": "rcm-2026.06-baseline"
  }
  ```
</ResponseExample>